Overview
overview
10Static
static
f5068e95e1...T1.exe
windows10-2004_x64
10f5068e95e1...dH.exe
windows10-2004_x64
10f5068e95e1...ty.ps1
windows10-2004_x64
1f5068e95e1...st.exe
windows10-2004_x64
1f5068e95e1...cb.exe
windows10-2004_x64
10f5068e95e1...ry.ps1
windows10-2004_x64
1f5068e95e1...ue.ps1
windows10-2004_x64
1f5068e95e1...me.ps1
windows10-2004_x64
1f5068e95e1...ry.ps1
windows10-2004_x64
1f5068e95e1...ue.ps1
windows10-2004_x64
1f5068e95e1...ry.ps1
windows10-2004_x64
1f5068e95e1...me.ps1
windows10-2004_x64
1f5068e95e1...ue.ps1
windows10-2004_x64
1f5068e95e1...UI.exe
windows10-2004_x64
1f5068e95e1...nl.ps1
windows10-2004_x64
1f5068e95e1...wp.exe
windows10-2004_x64
1f5068e95e1...zg.exe
windows10-2004_x64
10f5068e95e1...st.exe
windows10-2004_x64
1f5068e95e1...tb.exe
windows10-2004_x64
10f5068e95e1...ar.exe
windows10-2004_x64
10Analysis
-
max time kernel
139s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
17-06-2022 21:38
Static task
static1
Behavioral task
behavioral1
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral2
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/BIozhqydH.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/CL_Utility.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral4
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/DismHost.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/IoJbxlqcb.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral6
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/RS_AdminDiagnosticHistory.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/RS_MachineWERQueue.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral8
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/RS_SyncSystemTime.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/RS_UserDiagnosticHistory.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral10
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/RS_UserWERQueue.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/TS_DiagnosticHistory.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral12
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/TS_InaccurateSystemTime.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/TS_WERQueue.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral14
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/Video.UI.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/__PSScriptPolicyTest_eg4nc2yx.0nl.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral16
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/aspnet_wp.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/esfctKdzg.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral18
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/smsvchost.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/w..orIFtb.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral20
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/xpertwar.exe
Resource
win10v2004-20220414-en
General
-
Target
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe
-
Size
172KB
-
MD5
2e6f05e8245b62297355f070a6f966df
-
SHA1
7461222b5d34eb2328c7d50a75956f9dc78c32a3
-
SHA256
f5c1bcee04671046761d44546a3e4a413049a42cd9067caa25e7640ab5867178
-
SHA512
44302f90666acbaaedc8c4a8481cc2fdc82da786514683d5c5664f5b6eda7ee4e415e2c4155b1e92f7d93d82ddd60d6f652e35332b5ce50eba84897c5202a899
Malware Config
Signatures
-
Processes:
A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe -
Processes:
A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1 = "C:\\Users\\Admin\\AppData\\Roaming\\A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1\\A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe" iexplore.exe -
Processes:
A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1 = "C:\\Users\\Admin\\AppData\\Roaming\\A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1\\A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1 = "C:\\Users\\Admin\\AppData\\Roaming\\A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1\\A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe" iexplore.exe -
Processes:
A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1204 3656 WerFault.exe iexplore.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exedescription pid process target process PID 1568 set thread context of 3656 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe PID 1568 set thread context of 2380 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exepid process 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iexplore.exedescription pid process Token: SeDebugPrivilege 2380 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exeiexplore.exepid process 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe 2380 iexplore.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exedescription pid process target process PID 1568 wrote to memory of 3656 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe PID 1568 wrote to memory of 3656 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe PID 1568 wrote to memory of 3656 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe PID 1568 wrote to memory of 3656 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe PID 1568 wrote to memory of 3656 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe PID 1568 wrote to memory of 3656 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe PID 1568 wrote to memory of 3656 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe PID 1568 wrote to memory of 3656 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe PID 1568 wrote to memory of 2380 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe PID 1568 wrote to memory of 2380 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe PID 1568 wrote to memory of 2380 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe PID 1568 wrote to memory of 2380 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe PID 1568 wrote to memory of 2380 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe PID 1568 wrote to memory of 2380 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe PID 1568 wrote to memory of 2380 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe PID 1568 wrote to memory of 2380 1568 A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4\Downloaded_files\A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe"C:\Users\Admin\AppData\Local\Temp\f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4\Downloaded_files\A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe"1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4\Downloaded_files\A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 843⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4\Downloaded_files\A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3656 -ip 36561⤵